The approaches described in this section could be pursued, but are not necessarily approaches that have been previously conceived or pursued. Therefore, unless otherwise indicated herein, the approaches described in this section are not prior art to the claims in this application and are not admitted to be prior art by inclusion in this section.
In a data network that addresses data packets according to the Internet Protocol (IP) network layer protocol, each device within the network may be identified by an IP address. In a network that uses Ethernet as a data link layer, each device within the network may be identified by a Media Access Control (MAC) address.
In a network that uses IP over Ethernet, a network switch may maintain an Address Resolution Protocol (ARP) table that includes one or more mappings between IP addresses and MAC addresses. The ARP table is constrained to include at most one MAC address per a given IP address. If the network switch receives a data packet that is addressed to an IP address that maps to a MAC address of a device that is connected to the network switch, then the network switch delivers the data packet to that device.
If the network switch receives a data packet that includes an IP address that is not mapped to a MAC address that is in the ARP table, then the network switch broadcasts an ARP request within the network switch's broadcast domain. A reply to the ARP request means that some device has already been assigned the IP address. From the reply, the network switch knows the MAC address associated with the IP address. This association between the IP address and the MAC address is then stored as a mapping in the network switch's ARP table for future use. The switch then forwards the data packet to the MAC address. Alternatively, if there is no reply to the ARP request, then the network switch drops the data packet.
Using such mappings, network service providers attempt to ensure that those to whom data packets are not addressed do not receive those data packets. Additionally, network service providers use such mappings to attempt to limit network service to known subscribing devices.
A network switch may receive an ARP message, typically sent from a default gateway, which reveals a MAC address that is associated with a specified IP address. The network switch may update its ARP table to include a mapping between these addresses, replacing any existing mapping that includes the IP address.
A devious user can trick the network switch into including an illegitimate mapping in the network switch's ARP table. The user accomplishes this by conducting an ARP attack. To conduct an ARP attack, the user may send an ARP message to a network switch, computer, or network device that he wants to attack. The ARP message includes the user's device's MAC address and an IP address (possibly the IP address of the default gateway) that is already included in the ARP table. When the network switch receives the ARP message, the network switch ignorantly alters its ARP table to include the illegitimate mapping between the IP address and the user's device's MAC address. As a result, the devious user can receive packet traffic intended for another. The above technique may be referred to as “IP spoofing.” Thereafter, the network switch incorrectly delivers, to the devious user's device, any data packets that are addressed to the IP address.
In addition, the devious user can attack the default gateway using the same technique. The devious user may prevent anyone from detecting this deception by instructing his device to forward data packets to the destination for which those data packets were actually intended. The security and privacy of the network are thereby compromised. The devious user may obtain important personal information such as bank account, credit card information, user account login and password, etc. Consequently, current and potential subscriber confidence is eroded. Furthermore, the devious user may use a similar technique to obtain network service while avoiding subscription. As a result, network service provider resources are depleted. Additionally, network activities of the devious user may be incorrectly imputed to someone who did not participate in those activities. Consequently, someone may be billed for services that he did not use. Moreover, a network service provider's legally required records may fail to reliably indicate, for each one of the network service provider's IP addresses, a user that is associated with that IP address.
Some approaches that attempt to prevent IP spoofing use a MAC address to identify a legitimate subscribing device. Such approaches attempt to prevent a legitimate IP address from being mapped to a MAC address that is not authoritatively associated with that IP address. Unfortunately, such approaches do not prevent a devious user from changing his device's MAC address to duplicate a MAC address that is legitimately associated with an IP address (i.e., “MAC address spoofing”). One popular operating system, Microsoft Windows 2000, provides a user with an interface that allows the user to alter the MAC address of the device that executes the operating system.
A theoretical approach to prevent network address spoofing could involve implementing more intelligent network switches. Unfortunately, such an approach would not avail network service providers that have already deployed numerous network switches that lack such intelligence. Replacing so many existing network switches may not be economical. Furthermore, until more intelligent network switches become available, such an approach remains strictly theoretical.
Another disadvantage to existing approaches that attempt to prevent network address spoofing is the limited action that these approaches take in response to detecting such spoofing. Typically, in response to detecting a spoofed network address, existing approaches do little else beyond dropping unrecognized packets. Thus, a devious user is not effectively deterred from future spoofing attempts (e.g., conducting additional ARP attacks).
Based on the foregoing, there is a clear need for an effective way to prevent the spoofing of MAC addresses and IP addresses with existing network switches.